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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
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earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)E3 Responsive to communication(s) filed on 07 March 2007 . 
2a)^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 1-20 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)S The drawing(s) filed on 26 August 2003 is/are: a)E3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 
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application from the International Bureau (PCT Rule 17.2(a)). 
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DETAILED ACTION 



1 . Applicant's response filed on March 7, 2007 has been carefully considered 
Claims 1-10, 19 have been amended. New claim 20 has been added. Claims 1-20 are 
pending. 



Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by 
the applicant for patent, except that an international application filed under the treaty defined in 
section 351(a) shall have the effects for purposes of this subsection of an application filed in the 
United States only if the international application designated the United States and was published 
under Article 21(2) of such treaty in the English language. 

3. Claims 1-20 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Gupta et al. (U.S. Pub. No. 2003/0009699 A1), hereinafter "Gupta". 

Referring to claim 1 : 
Gupta teaches: 

A computer readable medium storing a computer program for a 
controlling apparatus, wherein said computer program causes said controlling 
apparatus to execute procedures of: 

monitoring a frequency of communications from said controlling 
apparatus to the outside (see figure 2, element 62 'anomaly detector'; page 12, 
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paragraph [0149]; page 5, paragraph [0069]; and page 6, paragraph [0082] of Gupta); 
and 

detecting computer virus infection at the controlling apparatus by 
means of comparing the monitored frequency of communications with a preset 
threshold value (see page 12, paragraph [0149] of Gupta). 
Referring to claims 2.11 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the plurality of external devices (see page 13, paragraph [0161], last 3 
lines of Gupta). 

Referring to claims 3, 12 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the specific destination port (see page 8, paragraph [0103] of Gupta). 
Referring to claims 4, 18 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the warning message (see page 4, paragraph [0055] of Gupta). 
Referring to claims 5, 13 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the time interval (see page 6, paragraph [0077] of Gupta). 
Referring to claims 6, 14 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses monitoring a number of packets that are associated with a specific 
destination port number (see page 8, paragraph [0103] of Gupta). 
Referring to claims 7, 15 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
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further discloses the connection request packet (see page 8, paragraph [0103], TCP 
SYN packet, of Gupta). 

Referring to claim 8 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the controlling apparatus (see e.g. figure 1, element 27-0 of Gupta). 
Referring to claim 9, 17 : 

Gupta discloses the claimed subject matter: A computer readable medium 
storing a computer program for a controlling apparatus (see claim 1 above). Gupta 
further discloses the image forming apparatus (see figure 14, element 122 'printer 1 of 
Gupta). 

Referring to claims 10, 19 : 
Gupta teaches: 

A controlling apparatus comprising: 

a monitor for monitoring a frequency of communications from said 
controlling apparatus to the outside (see figure 2, element 62 'anomaly detector'; page 
12, paragraph [0149]; page 5, paragraph [0069]; and page 6, paragraph [0082] of 
Gupta); 

a detector for detecting computer virus infection at said controlling 
apparatus by comparing the monitored frequency of communications with a preset 
threshold value (see page 12, paragraph [0149] of Gupta); and 

printing out a warning content when computer virus infection is 
detected (see page 12, paragraph [0149], 'generate an alert when traffic exceeds a 
predetermined high water mark for a given zone, such as a single server, a sub-net, an 
enterprise network, and the like', of Gupta). 
Referring to claim 16 : 

Gupta discloses the claimed subject matter: a controlling apparatus (see 
claim 10 above). Gupta further discloses the frequency of the connection request 
packet (see page 8, paragraph [0103], TCP SYN packet; and page 12, paragraph 
[0149], 'generate an alert when traffic exceeds a predetermined high water mark for a 
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given zone, such as a single server, a sub-net, an enterprise network, and the like', of 
Gupta). 

Referring to claim 20 : 

Gupta discloses the claimed subject matter: a controlling method used in 
controlling apparatus (see claim 19 above). Gupta further discloses the controller (see 
page 11, paragraph [0134], This implementation is in the form of a general-purpose 
computer', of Gupta). 



Response to Arguments 

4. Applicant's arguments filed on March 7, 2007 have been fully considered 
but they are not persuasive. 

Applicant argues: 

"Therefore, it is necessary to monitor data received from outside, rather than data 
being sent to outside,..." (see page 1, last line, Applicant Arguments/Remarks). 
Examiner maintains: 
Gupta discloses: 

"[0069] The second anomaly detection technique of traffic profiling characterizes 
the normal behavior of the target system. This behavior can be termed connectivity 
behavior, as it describes traffic flowing over the target system's connection to a network . 
The target system can be a whole enterprise network, an individual server or host 
machine, a class of services on a machine, or a particular user on a machine. Packet 
length and packet rate are the two most basic measures on a link." (see page 5, 
paragraph [0069] of Gupta, emphasis added). Thus, Gupta discloses the traffic flow 
from the target system to a network [i.e., outbound]. 

Gupta further discloses "[0082] By identifying the set of commonly used reguest- 
response packet pairs and creating a simple balance profile , the anomaly detector 62 
detects most attacks. This is accomplished by: (1) keeping a run-time count of request 
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and response packets separately, (2) establishing a rate profile for the occurrence of 
these individual packets and generate an alert if the threshold of deviation is crossed, 
and then (3) correlate the request and response by simply checking the balances. 
Request-response examples include: TCP SYN-TCP SYN & ACK; TCP FIN-TCP FIN & 
ACK; CIMP ECHO REQ-ICMP ECHO REPLY, ARP request-ARP response, DNS 
query-query response, HTTP request-response." (see page 6, paragraph [0082] of 
Gupta, emphasis added). Thus, Gupta discloses identifying the commonly used 
request-response packet pairs [i.e., inbound and outbound traffic], and creating a simple 
balance profile. 

Applicant argues: 

"Gupta does not disclose special functions such as monitoring data and detecting 
virus at the printer itself." (see page 2, 4 th paragraph, Applicant Arguments/Remarks, 
emphasis added) 

Examiner maintains: 

The specification of the application discloses: 

"[0023] The network system shown in FIG. 1 has a Multi-Function Peripheral 
(MFP) 100. MFP 100 is equipped with a computer 200, which functions as a controlling 
apparatus, and a copying machine 300 connected to computer 200 via a cable 500 ." 
(see Kaneko, emphasis added) 

Gupta discloses that a sensor has the capability of monitoring data and detecting 
virus in inbound/outbound traffic in a network (see e.g. figure 2, element 62 'Anomaly 
Detector', element 60 'Statistics Analysis and DDOS Detection Module', element 55 
'Attack Detector' of Gupta) 

Gupta further discloses "In addition, a local sensor security module 27_0 is 
positioned between the enterprise network 30 and a protected server 32" (see page 2, 
paragraph [0033], lines 8-10 of Gupta). Therefore, the local sensor 30 monitors data 
and detects virus for the protected server 32, and functions as a controlling apparatus of 
the protected server 32 . 
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Conclusion 

5. Applicant's amendment necessitated the new ground(s) of rejection 
presented in this Office Action. Accordingly, THIS ACTION IS MADE FINAL. See 
MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 
37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is filed 
within TWO MONTHS of the mailing date of this final action and the advisory action is 
not mailed until after the end of the THREE-MONTH shortened statutory period, then 
the shortened statutory will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Joseph Pan whose telephone number is 571-272- 
5987. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Kim Vu can be reached at 571-272-3859. The fax and phone 
numbers for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Any inquiry of a general nature or relating to the status of this application 
or proceeding should be directed to the receptionist whose telephone number is 571- 
272-2100. 
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